Enterprise DFIR: AI-Assisted Investigations

Modern enterprise intrusions involve sophisticated attacker techniques spanning endpoints, networks, identities, and security infrastructure. Investigating these threats requires analysts to understand attacker behavior, correlate evidence across multiple sources, and reconstruct complex attack sequences.

In this two-day, hands-on workshop, participants investigate realistic ransomware and APT intrusion scenarios using forensic datasets and industry-standard tools, including SIEMs and forensic utilities.

Through practical exercises, students learn to investigate commonly observed attacker techniques, including SSH reverse tunneling, RDP-based lateral movement, in-memory execution, Kerberoasting, credential abuse, and defense evasion using vulnerable drivers (BYOVD).

Throughout the workshop, we also explore how AI can augment traditional DFIR workflows. Participants apply modern investigation methodologies, progressing from hands-on forensic analysis to AI-assisted artifact interpretation, evidence correlation, investigative decision-making, and automated triage.

Using practical examples, reusable code snippets, and lightweight investigation harnesses, students learn how to integrate LLMs into selected DFIR workflows, evaluate AI-generated findings, and apply best practices for evidence-driven analysis.

The focus is on developing practical investigation skills while learning how AI can help analysts work more efficiently—not on building AI applications from scratch.

Who Should Take This Course

SOC analysts, incident responders, threat hunters, DFIR practitioners, and security engineers looking to strengthen their practical enterprise investigation skills and explore how AI can augment their existing workflows.

Participants will gain hands-on experience investigating real-world attacker techniques while exploring how AI-assisted analysis and automation can improve investigative efficiency, detection engineering, and incident response workflows.

Participants should have a basic understanding of Windows systems, networking, and security fundamentals. No prior AI development experience is required.

What You’ll Learn

• Enterprise DFIR fundamentals: Apply structured investigation methodologies across endpoint, network, and authentication evidence.
• Ransomware and APT investigations: Investigate SSH tunneling, lateral movement, in-memory execution, Kerberoasting, credential abuse, and BYOVD techniques.
• Forensic analysis and correlation: Analyze Windows artifacts, event logs, memory evidence, and network telemetry to reconstruct attacker activity.
• AI-assisted investigation and detection engineering: Use LLMs to interpret evidence, develop investigative queries and detection logic, correlate events, and identify suspicious behavior.
• Practical AI automation: Explore reusable code snippets and lightweight investigation harnesses for triage, classification, and evidence analysis.

Key Takeaways

• Investigate realistic ransomware and APT-style incidents using modern DFIR techniques.
• Analyze host, network, and log evidence to reconstruct attacker activity.
• Investigate common TTPs, including credential abuse, lateral movement, in-memory execution, and defense evasion.
• Apply AI-assisted workflows to accelerate forensic triage, evidence correlation, and detection engineering.
• Explore practical AI automation using reusable code snippets and lightweight investigation harnesses.